School Management System CMS 1.0 is vulnerable to an SQL injection attack that targets the admin login. By inserting malicious code into the username field, an attacker can manipulate the login query and bypass authentication, gaining full administrator privileges. This allows complete control over the system’s functions and data. The weakness is a classic SQL injection (CWE‑89).

The affected product is Wecodex Solutions School Management System CMS, version 1.0. No additional versions are listed in the vulnerability report.

The CVSS score of 7.1 indicates high potential impact. External exploitation is possible through the publicly accessible processlogin endpoint; no prior authentication is required. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a widely exploited vulnerability yet. However, the lack of input validation means an attacker can easily craft requests that bypass authentication and execute arbitrary SQL. Given the severity and ease of exploitation, the risk of a successful attack is significant.